General

  • Target

    0adf953605c610880f4095b3b33ea2d9_JaffaCakes118

  • Size

    12KB

  • Sample

    241002-qn6hmssbph

  • MD5

    0adf953605c610880f4095b3b33ea2d9

  • SHA1

    be85a2e4a9283044d7bd99c3bb90fe58003042ef

  • SHA256

    3fb9c26fde2911b52416edf8e88b16fbd113ad8eb03998220d18a6b75ad611c7

  • SHA512

    ee6bc401f00c8f65ad8a74518a82eebee3cc0a25a917c48c9188e80e88559a7d7e244468cfc202c1deb36ce594517b7632e7bf82f4be89d77f56014349ba60c8

  • SSDEEP

    192:J/TrG62a6B10k3g4fXk1iTV3HGc7EkpAqEjaGpsHcxUw4h+lfPtwMCZgWOS9p:JebFNw4Pk1itKkpAjjJs6B40tCyWOg

Malware Config

Targets

    • Target

      0adf953605c610880f4095b3b33ea2d9_JaffaCakes118

    • Size

      12KB

    • MD5

      0adf953605c610880f4095b3b33ea2d9

    • SHA1

      be85a2e4a9283044d7bd99c3bb90fe58003042ef

    • SHA256

      3fb9c26fde2911b52416edf8e88b16fbd113ad8eb03998220d18a6b75ad611c7

    • SHA512

      ee6bc401f00c8f65ad8a74518a82eebee3cc0a25a917c48c9188e80e88559a7d7e244468cfc202c1deb36ce594517b7632e7bf82f4be89d77f56014349ba60c8

    • SSDEEP

      192:J/TrG62a6B10k3g4fXk1iTV3HGc7EkpAqEjaGpsHcxUw4h+lfPtwMCZgWOS9p:JebFNw4Pk1itKkpAjjJs6B40tCyWOg

    • Renames multiple (2219) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Drops file in Drivers directory

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks